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The Claims: 

1. (Original) A method of detecting script language viruses in data streams 
comprising: 

preparing language description data corresponding to at least one script language; 
preparing detection data for viral code corresponding to the script language virus; and 
lexically analyzing a data stream using the language description data and the detection 
data to detect the viral code. 

2. (Original) The method of claim 1, wherein the language description data 
correspond to Dynamic Finite Automata data. 

3. (Original) The method of claim 2, wherein the Dynamic Finite Automata 
data comprises a set of states, with each state having a corresponding set of transaction 
having an associated character to be matched and an associated next state. 

4. (Currently Amended) The method of claim 1 5 wherein the language 
description data correspond to language definition rules and check rules , wherein the 
language definition rules include descriptions of constructs of the target script language 
and relationships between the constructs . 

5. (Original) The method of claim 4, wherein the lexical analysis includes one 
or more pattern matches based on the language definition rules. 

6. (Original) The method of claim 4, wherein a script language used by the data 
stream is determined by the lexical analysis using the language check rules. 

7. (Original) The method of claim 1 further comprising setting language 
definition rules for each of the least one script language. 

8. (Original) The method of claim 1, wherein the detection data comprise at 
least one test, wherein each of the at least one test correspond to a pattern match or a cyclical 
redundancy check. 
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9. (Original) The method of claim 1, wherein the step of preparing detection 
data comprises: 

obtaining samples of the viral code; 
analyzing the obtained samples; and 

setting a detection regimen that includes at least one pattern match or cyclical 
redundancy check based on the analysis of the obtained samples. 

10. (Original) The method of claim 1, wherein the data stream is converted to a 
stream of tokens using lexical analysis. 

11. (Original) The method of claim 10, wherein the tokens correspond to 
respective language constructs. 

12. (Original) The method of claim 10, wherein a cyclical redundancy check is 
performed on the stream of tokens to detect viral code. 

13. (Original) A program storage device readable by a machine, tangibly 
embodying a program of instructions executable by the machine to perform method steps for 
detecting script language viruses, the method steps comprising: 

preparing language description data corresponding to at least one script language; 
preparing detection data for viral code corresponding to the script language virus; and 
lexically analyzing a data stream using the language description data and the detection 
data to detect the viral code. 
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14. (Original) A computer system, comprising: 
a processor; and 

a program storage device readable by the computer system, tangibly embodying a 
program of instructions executable by the processor to perform method steps for detecting 
script language viruses, the method steps comprising: 

preparing language description data corresponding to at least one script language; 

preparing detection data for viral code corresponding to the script language virus; and 

lexically analyzing a data stream using the language description data and the detection 
data to detect the viral code. 

15. (Original) A computer data signal embodied in a transmission medium which 
embodies instructions executable by a computer for detecting a script language virus, 
comprising: 

a first segment including script language processor code to prepare language 
description data corresponding to at least one script language; 

a second segment including detection data processor code to prepare detection data 
for viral code corresponding to the script language virus; and 

a third segment including detection engine code to lexically analyze a data stream 
using the language description data and the detection data to detect viral code. 

16. (Original) An apparatus for detecting script language viruses, comprising: 

a script language processor, wherein the script language processor prepares language 
description data corresponding to at least one script language; 

a detection data processor, wherein the detection data processor prepared detection 
data for viral code corresponding to a script language virus; and 

a detection engine, wherein the detection engine lexically analyzes a data stream 
using the language description data and the detection data to detect the viral code. 

17. (Original) The apparatus of claim 16, wherein the language description data 
correspond to Dynamic Finite Automata data. 
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18. (Original) The apparatus of claim 17, wherein the Dynamic Finite Automata 
data comprises at least one set of states, with each state having a corresponding set of 
transitions and each transition having an associated character to be matched and an associated 
next state. 

19. (Currently Amended) The apparatus of claim 16, wherein the language 
description data corresponds to language definition rules and language check rules , wherein 
the language definition rules include descriptions of constructs of the target script 
language and relationships between the constructs . 

20. (Original) The apparatus of claim 19, wherein the lexical analysis by the 
detection engine includes one or more pattern matches based on the language definition rules. 

21. (Original) The apparatus of claim 19, wherein a script language used by the 
data stream is determined by the lexical analysis of the detection engine using the language 
check rules. 

22. (Original) The apparatus of claim 16, wherein the detection data comprises at 
least one test, and each of the at least one test correspond to a pattern match or a cyclical 
redundancy check. 

23. (Previously Presented) The apparatus of claim 16, wherein the detection 
engine converts the data stream of tokens using lexical analysis, and the tokens correspond to 
respective language constructs. 

24. (New) A method, comprising: 
receiving a data stream; 

lexically analyzing the data stream to identify at least one software operation 
associated with the data stream; and 

comparing the at least software operation with a repository of virus detection data. 
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25. (New) The method of claim 24, further comprising identifying a script 
language of the data stream. 

26. (New) The method of claim 25, wherein identifying the script language of the 
data stream comprises comparing portions of the data stream to language check rules stored 
in a language description database. 



DAL01:893829.1 



